Stolen AI Logins: 80,000+ Organizations Surface in Infostealer Logs

The summer of 2026 handed the security world a new phrase: the stolen AI login. In late August, Anthropic responded to infostealer-driven hijacking of Claude sessions by signing users out, wiping saved payment methods and refunding charges it deemed unauthorized. That was the supply side. SOCRadar's report tackles the demand side — the enterprises whose employees turn out to be the credentials being sold.

The scale

Starting from more than a million infostealer records tied to AI services across 80,000-plus corporate domains, the researchers narrowed the set to 482 major enterprises. Of those, 68% are billion-dollar organizations spanning 36 countries and eight sectors, concentrated in North America. Between them sit 5,434 records and 1,500 distinct corporate email addresses, with 295 companies surfacing in the last 90 days.

ChatGPT dominates

One platform swallows the chart: a captured ChatGPT or OpenAI session appears for 358 of the 482 companies and accounts for roughly 90% of all records. Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs trail far behind. Just as telling is who is absent — no Claude and no Gemini in the top ranks.

Researchers read this not as a verdict on any vendor's security but as a shadow-AI signal: thanks to first-mover advantage, far more employees quietly signed up with a work email on a personal device — and that is exactly the population infostealers scrape.

Why it beats a stolen password

An ordinary password unlocks one app. An AI account is four things at once: a searchable archive, an execution engine, a billable resource and an identity. Employees paste source code, customer records, contracts and unreleased plans into prompts, and whoever replays the session inherits all of it.

A stolen cookie is a live session that walks past MFA — rotating the password leaves the intruder signed in. Automation platforms hold standing OAuth grants into CRM, email and storage, so a stolen Zapier session lets an attacker build a workflow that exfiltrates data on a schedule. And copied API keys are either billed to the victim or resold: underground shops offer discounted access to Claude, Gemini and Cursor with money-back guarantees. That is LLMjacking.

What to do

The controls aren't exotic, but AI platforms now belong in the same tier as your identity provider and code repositories. SOCRadar advises putting every AI service behind SSO with short-lived sessions and refresh-token rotation, scoping, capping and rotating API keys, monitoring for session-token reuse (a mid-life change of country or device fingerprint signals a replay), and above all finding the shadow accounts already in stealer logs. An employee appearing in such a log should be treated as an endpoint incident, not a password reset.

Source: Bleeping Computer